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Abstract — In this paper, we study the continuous-time con- 
sensus problem in the presence of adversaries. The networked 
multi-agent system is modeled as a switched system, where 
the normal agents have integrator dynamics and the switching 
signal determines the topology of the network. We consider 
several models of omniscient adversaries under the assumption 
that at most a fraction of any normal agent's neighbors may be 
adversaries. Under this fractional assumption on the interaction 
between normal and adversary agents, we show that a novel 
graph theoretic metric, called fractional robustness, is useful 
for analyzing the network topologies under which the normal 
agents achieve consensus. 

I. INTRODUCTION 

Large-scale networks are ubiquitous in nature (e.g., flocks 
of birds or schools of fish) and are becoming increasingly 
more pervasive in engineered systems (e.g., large-scale sen- 
sor networks). For these systems, reaching consensus in a 
distributed manner is fundamental to coordination and is 
therefore a common objective in applications ranging from 
clock synchronization in sensor networks [1] to flocking [2]. 
However, large-scale distributed systems are susceptible to 
malicious attacks and failures. If a security breach occurs, 
many consensus algorithms fail to achieve consensus, and 
are therefore not resilient [3]. 

Fault-tolerant and resilient consensus algorithms have been 
studied extensively over the years [4], [5], particularly in the 
presence of Byzantine nodes under the assumption that at 
most F of the nodes are compromised [6]. Byzantine nodes 
are deceptive, can behave arbitrarily within the limitations set 
by the model of computation, and may be viewed as adver- 
sarial in nature. Many of the resilient consensus algorithms 
studied in the literature are computationally expensive and 
require at least some global information. However, a class 
of computationally efficient resilient consensus algorithms 
that use only local information are developed in [7] and 
[8], referred to as the Mean-Subsequence-Reduced (MSR) 
algorithms [8]. The idea behind the MSR algorithms is 
simple: under the assumption that at most F nodes fail, each 
normal node removes the largest and smallest F values (i.e., 
the extreme values) in its neighborhood and takes the average 
from a subset of the remaining values. MSR algorithms have 
been used extensively to achieve fault tolerant and resilient 
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consensus (e.g., in clock synchronization [1] and robot gath- 
ering [9]). However, the network topological condition for 
characterizing convergence has long been an open problem. 

Recently, it has been shown that traditional graph theoretic 
metrics (such as connectivity) are inadequate for characteriz- 
ing the conditions under which the MSR algorithms achieve 
resilient consensus [10], [11]. Because of the removal of 
extreme values in MSR algorithms, a property that encapsu- 
lates the notion of sufficient local redundancy of incoming 
information is needed. This idea is captured by network 
robustness [10], [12] and a similar property studied in [13]. 
Equipped with these properties, the necessary and sufficient 
conditions for convergence of a class of MSR algorithms 
have been given for the Byzantine model [13] and for a local 
broadcast version of the Byzantine model [12] (referred to as 
the malicious adversary), under the assumption that at most 
F nodes are compromised. 

In this paper, we continue our study of continuous-time 
versions of MSR algorithms [11], [12], [14]. We study both 
malicious and Byzantine adversaries, along with the crash 
adversary, which is inspired by the crash faulty robots in 
robot gathering [9] and is similar to the fault attack model of 
[15]. Instead of assuming an absolute bound on the number 
of compromised nodes in a normal node's neighborhood, we 
assume at most a fraction of nodes / may be compromised 
in the neighborhood. This fractional assumption accounts 
for the degree of influence on the nodes in the network. 
We adapt the continuous-time MSR algorithm, referred to as 
the Adversarial Robust Consensus Protocol (ARC-P) [11], 
[12], [14], to the fractional assumption. To analyze ARC- 
P under the fractional adversary assumption, we consider a 
fractional form of robustness, introduced in [16], and prove 
separate necessary and sufficient conditions under each of the 
adversary models. The necessary condition is stated in terms 
of time-invariant network topology, whereas the sufficient 
condition applies to time-varying network topologies that are 
sufficiently robust under a dwell time assumption. The main 
contribution of this paper is the continuous-time analysis 
under the fractional scope of threat assumption with the 
Byzantine, malicious, and crash adversary models. 

II. SYSTEM MODEL AND PROBLEM 
FORMULATION 

Consider a time-varying network modeled by the digraph 
T>(t) = (V,£(t)), where V = {1, ...,n} is the node (agent) 
set and £ (t) C V x V is the directed edge set at time t. 
Without loss of generality, the node set is partitioned into 
a set of N normal agents Af = {1,2, ... ,N} and a set 
of M adversary agents A = {N + 1, N + 2, . . . , n}, with 



M = n — N. Each directed edge G £ (t) indicates that 
node i can be influenced by node j at time t. In this case, 
we say that agent j conveys information to agent i. The sets 
of in-neighbors and out-neighbors of node i at time t are 
defined by A/>(t) = {j £ V: G £(t)} and M° ul {t) = 
{j e V: G £ (t)}, respectively. The set of all digraphs 
on n nodes is denoted by r n = {X>i, . . . , £>d}. 

The time-varying topology of the network is governed by a 
piecewise constant switching signal a: R>o — > {1, 
At each point in time t, er(i) dictates the topology of the 
network, and a is continuous from the right everywhere. 
In order to emphasize the role of the switching signal, we 
denote T> a M = T)(t). Note that time-invariant networks are 
represented by simply dropping the dependence on time t. 

The agents share state information with one another ac- 
cording to the topology of the network. Each normal agent's 
state (or value) at time t is denoted as Xj (t) G R. In order to 
handle deceptive adversaries, we let x/j^ (t) denote the state 
of agent j intended for agent i at time t. For consistency 
of notation, we define xy t) (t) for all j, i £ V, even if 
(j, i) £ £(t). In the case that j £ J\f is normal, we define 
xtjMt) = Xj(t) (and in particular, X(jj\(t) = Xj(t)). With 
this terminology, we denote the collective states of all agents 
in Af, A, and V intended for agent i by 

*(/¥-,<)(*) = [xi(t),...,x N (t)] T GR N , 

X(A,i)(t) = [X(N+l,i)(t), ■ ■ ■ ,X( n ,i)(t)] T G M M , 

and 

^CV.ijC*) = [^(l.i)^))---) 31 ^)^)] 1 " e M "' 

respectively. Since X(jv",i)(i) = Xrj^j){t) for all i,j G V, 
we unambiguously define xj^(t) = xy^^{t) for any i G 
V. Finally, we denote the vector containing all adversary 
states intended for the normal agents by x^^(t) = 

[ x J Atl) (t),...,xJ AtN) (t)] r eR MN . 

A. Normal Agent Dynamics 

Each normal agent i 6 Af has scalar state Xi(t) G R 
and integrator dynamics given by X{ = U{, where u 2 ; = 
fi.cr(t) {t, xj^f, X(A,i) ) is a control input. Because there is no 
prior knowledge about which agents are adversaries, the con- 
trol input must treat the state information from neighboring 
agents in the same manner. The system of normal agents are 
then defined for t G R>o by 

xj\[{t) = fa(t){t,xu,x {A ^)), x^(0) G R N ,V a{t) G T n , 

(1) 

where f a{t ){-) = L/V(t)(0> • • • »/jv,<r(i)(-)] T ' Note that for 
existence of solutions on R>o, the f^ a (t) (')' s mu st be 
bounded and piecewise continuous with respect to the ad- 
versaries' trajectories. These functions should be designed a 
priori so that the normal agents can reach consensus without 
prior knowledge about the identities of the adversaries. 

B. Adversary Model 

The adversary model studied in this paper has two aspects: 
the threat model and the scope of threat assumption. 



1 ) Threat Model: The threat model defines the types of 
behaviors allowed by individual adversary nodes. The least 
general threat is the crash adversary, which is inspired by the 
crash fault studied in mobile robotics [9]. As a fault model, 
crash-faulty robots fail by simply stopping. Analogously, a 
crash adversary behaves normally until it is crashed and once 
crashed, stops changing its state. The crash adversary deter- 
mines when the node is crashed, but otherwise cannot modify 
the state of the compromised agent or the values conveyed 
to other nodes. Crash adversaries - like all adversary models 
studied here - are assumed to be omniscient (i.e., they know 
all other states and the full network topology; they are aware 
of the update rules fi ta (t)(')> 6 N; they are aware of 
which other agents are adversaries; and they know the plans 
of the other adversaries^. For this reason, the worst case 
crash times for the adversaries should be considered. This 
behavior is summarized in the following definition. 

Definition 1 ( Crash Adversary): An agent k G A is a 
crash adversary (or simply crash node) if it is omniscient, 
and there exists G R>o (selected by the adversary), such 
that 

* agent k behaves normally before t — ifc, according to 
its prescribed update rule, i.e., 

Xk = fk^(t)(t,xjv,X( A ^ k) ) for all t < t k \ 

> agent k stops changing its state for all t > t k , i.e., 

Xk(t) = x k (t k ) for all t > t k ; 
« agent k conveys the same state to each out-neighbor, 

i.e., ee x {kJ) for all i,j G A/£ ut . 

□ 

The crash adversary is similar to the fault attack model 
described in [15]. The fault attack assumes that the state of 
the attacked node remains constant, as with a crashed node; 
however, the constant value imposed by the attack may be 
arbitrary instead of being fixed at the state value immediately 
before the attack. 

Conversely, the most general threat studied here is the 
Byzantine adversary. The Byzantine adversary is motivated 
by Byzantine faulty nodes studied in distributed comput- 
ing [4], [6], communication networks [5], [17], and mobile 
robotics [9]. Byzantine nodes may behave arbitrarily (under 
a continuity constraint), are omniscient, and are capable of 
duplicity, i.e., the values conveyed to their out-neighbors are 
not necessarily the same. 

The malicious adversary is essentially a Byzantine node 
restricted to a local broadcast model of communication. A 
malicious adversary may behave arbitrarily and is omni- 
scient. However, malicious nodes are incapable of duplicity, 
i.e., every out-neighbor receives the same information. 

Malicious nodes have been studied in the detection and 
identification of misbehaving nodes in discrete-time linear 
consensus networks [18], [19]. In these works, a malicious 
node is modeled by introducing a disturbance on its input 
that allows the malicious node to modify its state arbitrarily. 

'One may take the viewpoint that a centralized omniscient adversary 
informs and directs the behavior of the individual adversary agents. 



To identify the malicious nodes, normal nodes use nonlo- 
cal topological information concerning the (time-invariant) 
network to 'invert' the consensus dynamics of the network. 

A technical assumption for malicious and Byzantine 
agents deals with the continuity of the state trajectories 
of the adversaries. Technically, piecewise continuity of the 
trajectories of X(Aji/\(t) (combined with certain regularity 
conditions on f a (t)(')) is sufficient for existence of solutions 
to (|l]). However, the trajectories of the normal agents are con- 
tinuous; therefore, it is feasible that normal agents could use 
discontinuities in the state trajectories to detect adversaries. 
Thus, we restrict the trajectories of Byzantine adversaries 
to be continuous for all t. The behavior of Byzantine and 
malicious agents are summarized as follows. 

Definition 2 (Byzantine and Malicious Agents): An agent 
k G A is a Byzantine or malicious adversary if it is 
omniscient, and 

• agent k's state trajectories intended for other nodes, 
{ x {k,i) (A) : i G y }> are continuous functions of time 
on [0, oo); 

• Byzantine agent k's state trajectory intended for i may 
be different than the one intended for j, i.e., x/k,i) CO 7^ 
x (k,j)(t) is allowed for some i, j G V; 

• malicious agent k's state trajectory intended for i must 
be the same as the one intended for j, i.e., Xrf-,i){t) = 
X(k,j)(t),Vi,j G V. 

□ 

2) Scope of Threats: The scope of threat model defines 
the topological assumptions placed on the adversaries. To 
account for varying degrees of different nodes, we introduce 
a fault model that considers an upper bound on the fraction 
of adversaries in any node's neighborhood. This is called the 
f -fraction local model. 

Definition 3 ( f -Fraction Local Set and Threat Model): 
A set iS C V is /-fraction local if and only if it contains at 
most a fraction / of agents in the neighborhood of the other 
agents for all t, i.e., \N?{t) f]S\ < L/|A^ in (t)|J, Mi G V\5, 
/ G [0,1]. The /-fraction local model refers to the case 
when the set of adversaries is an /-fraction local set. □ 

It should be emphasized that in time-varying network 
topologies, the property defining an /-fraction local set must 
hold for all points in time. The /-fraction local model is 
inspired from ideas pertaining to contagion in social and 
economic networks [20], where a node accepts some new 
information (behavior or technology) if more than a certain 
fraction of its neighbors has adopted it. A scope of threat 
model similar to the /-fraction local model is proposed in [1] 
for hierarchical networks to address the problem of resilient 
clock synchronization in the presence of Byzantine nodes. 

C. Resilient Asymptotic Consensus 

The Continuous-Time Resilient Asymptotic Consensus 
(CTRAC) problem is a continuous-time analogue to the 
Byzantine approximate agreement problem [4], [7], and is 
defined as follows. The quantities Mj^(t) and mj^{t) are 
the maximum and minimum values of the normal agents at 
time t, respectively. 



Definition 4 (CTRAC): The normal agents are said to 
achieve continuous-time resilient asymptotic consensus 

(CTRAC) in the presence of adversary agents (given a 
particular adversary model) if 

(i) 3L G K such that lim^oo Xi(t) = L for all i e Af; 

(ii) Xi(t) G Z = [m^(0),M Ar (0)], Vi G M> , i G A/", 

for any choice of initial values xjv(0) G Mr. □ 
The CTRAC problem is defined by two conditions, agree- 
ment and safety, along with the type of adversary considered. 
Condition (i) is an agreement condition that requires the 
states of the normal agents to converge to a common limit, 
the consensus value, despite the influence of the adversaries. 
The safety condition in (ii) ensures that the value chosen 
by each normal agent lies within the range of 'good' values. 
This is important in safety critical applications, whenever Xq 
is a known safe set. 

III. RESILIENT CONSENSUS ALGORITHM 

Linear consensus algorithms have been extensively studied 
in the control community for the last few years [21]. In such 
strategies, at time t, each node senses or receives information 
from its neighbors, and changes its value according to the 
Linear Consensus Protocol (LCP): 

*i(0 = ^2 w (hl) (t)(x (hl) (t) - Xi(t)) , (2) 

where xij^(t) — Xi(t) is the relative state of agent j with 
respect to agent i and wu^it) is a piecewise continuous 
weight assigned to the relative state at time t. 

Different conditions have been reported in the literature to 
ensure that asymptotic consensus is reached [2], [22], [23]. 
It is common to assume that the weights are nonnegative, 
uniformly bounded, and piecewise continuous. That is, there 
exist constants a, f3 G M >0 , with (3 > a, such that the 
following conditions hold: 

. w UA) {t) = whenever j £ A/| n (t),Vi G Af, t G R> ; 

• a < w Uti) (t) < (3, Wj G A^ n (i), i G N, t G R> . 

One problem with LCP given in ^ is that it is not resilient 
to misbehaving nodes. In fact, it is shown in [2], [3] that a 
single 'leader' node can cause all agents to reach consensus 
on an arbitrary value of its choosing simply by holding its 
value constant. 

A. Description of ARC- P with Parameter f 

The Adversarial Robust Consensus Protocol (ARC-P) with 
parameter F G Z>o was introduced in [14] and extended 
in [12] to deal with the F-total and f-local scope of 
threat models. By removing the extreme values with respect 
to the node's own value (the F largest and F smallest 
values), ARC-P with parameter F is able to achieve resilient 
asymptotic consensus [12]. Under the /-fraction local model, 
a minor modification to this protocol is needed. In this 
case, the parameter / G [0,1/2] determines the fraction 
of neighboring values to view as extreme. For example, if 
f = 1/3, then ARC-P with parameter / removes the largest 
and smallest one third of the neighboring values. 



For describing the algorithm, let Fi(t) = \_fdi(t)\. When- 
ever the normal nodes assume the /-fraction local model, at 
most [fdi(t)\ of node i's neighbors may be compromised, 
and the parameter used is /.(] The following steps describe 
ARC-P with parameter /. 

1) At time t, each normal node i obtains the values of its 
in-neighbors, and forms a sorted list. 

2) If there are less than Fj (t) values strictly larger (smaller) 
than its own value, Xi(t), then normal node i removes 
all values that are strictly larger (smaller) than its own. 
Otherwise, it removes precisely the largest (smallest) 
Fi(t) values in the sorted list.[] 

3) Let TZi(t) denote the set of nodes whose values are 
removed by normal node i in step 2 at time t. Each 
normal node i applies the update| 

*»(*)= ^2 w (j,i)i t ) ( x (j,i)( t ) • ( 3 ) 

The set of nodes removed by normal node i, lZi(t), is pos- 
sibly time-varying. Thus, even if the underlying network is 
fixed, ARC-P effectively induces switching behavior, which 
can be viewed as the linear update of (Q) with the rule given 
in step 2 for state-dependent switching. 

IV. FRACTIONAL NETWORK ROBUSTNESS 

Network robustness captures a notion of local redundancy 
of information flow in the network that is well suited for 
scope of threat models with absolute bounds on the number 
of adversaries in a normal node's neighborhood [24]. For 
the /-fraction local model, there is no absolute bound on 
the number of neighbors that may be adversaries. Rather, 
it stipulates a bound on the fraction of neighbors that can 
be adversaries. Hence, for the /-fraction local model, we 
require a fractional notion of robustness. First, we define a 
p-fraction edge reachable set. 

Definition 5: Given a nonempty digraph V and a 
nonempty subset S of nodes of £>, we say S is a p-fraction 
edge reachable set if there exists i G S such that | A/} 11 1 > 
and \N?\S\ > b|A/; in |1, where <p < 1. If |A] n \S| = 
for all i £ S, then S is 0-fraction edge reachable. □ 

A set S is p-fraction edge reachable, for p > 0, if it 
contains a non-isolated node i (i.e., di > 0) that has at least 
\pdi~] neighbors outside of S. The parameter p quantifies 
the ratio of influence from neighbors outside S to neighbors 
inside S for at least one node inside S. Note that the notion 
of fraction edge reachability is also called cohesiveness in 
the contagion literature [20]. 

To illustrate p-fraction edge reachability, consider the sets 
Si, S2, and 53 in Figure |l| Each node in Si has 3/5 of 
its neighbors outside Si; so Si is | -fraction edge reachable. 
Node 8 has 5/6 of its neighbors outside of S2, and node 
9 only has 4/5 of its neighbors outside of S2. Thus, S2 

2 Of course, if the scope of threat model assumed (i.e., at design time) is 
not the true scope of threat, then ARC-P may fail to achieve consensus. 

3 Ties may be broken arbitrarily. However, it is required that the algorithm 
is able to match the correct weights to the values kept. 

4 Note that if all neighboring values are removed, then i';(t) = 0. 
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Fig. 1. Graph for illustrating edge reachability properties. 

is |-fraction edge reachable. Lastly, S3 is a non-isolated 
singleton, so S3 is 1 -fraction edge reachable. 

The p-fraction edge reachability property is defined with 
respect to a specific set of nodes. We now use this concept 
to define a network- wide property as follows. 

Definition 6 (p-fraction robustness): A nonempty, non- 
trivial digraph V = (V,£) is p-fraction robust, with < 
p < 1, if for every pair of nonempty, disjoint subsets of V, 
at least one of the subsets is p-fraction edge reachable. If T> 
is empty or trivial, then V is 0-fraction robust. □ 

V. RESILIENT CONSENSUS ANALYSIS 

We demonstrate in this section how fractional robustness 
is a useful property for analyzing ARC-P with parameter 
/ under the /-fraction local model. More specifically, we 
show that /-fraction robustness is necessary in the presence 
of crash adversaries and 2/-fraction robustness is sufficient 
in the presence of Byzantine adversaries. First, we consider 
the safety condition. 

Lemma 1: Consider the normal agent i £ N using ARC- 
P with parameter / G [0,1/2] under the /'-fraction local 
(Byzantine) model, where /' < /. Define Fi(t) = [fdi(t)\. 
Then, for each t G M>o, 

B(mj^(t) - x t (t)) < fi !<7 ( t )(t,XM,X( Ati )) 
< B{M M {t)-Xi{t)), 

where B — f3(n — 1 — mm i£ N.t>o{Fi(t)}), which implies 
that the safety condition of the CTRAC problem is ensured. 

Proof: If no neighboring values are used, or all values 
used are equal to Xi(t) at time t, then f M ^ (t, xj\r, ^(.4,i)) = 
0, and the inequality holds. Therefore, assume at least one 
value not equal to Xi(t) is used in the update at time t, say 
XQi)(t). Suppose xrj{\(t) > Mj^f(t). Then, by definition 
j must be an adversary and xuMt) > Xi(t). Since i uses 
XQi)(t) at time t, there must be at least Fi(t) more agents 
in the neighborhood of i with values at least as large as 
xq- i) (t). Hence, these agents must also be adversaries, which 
contradicts the assumption of at most Fi (t) adversary agents 
in the neighborhood of i at time t. Thus, x^j^(t) < Mj^(t). 
Similarly, we can show that xu t i)[£) > m^/(t). Since there 
are at most n — 1 neighbors of i, at least Fi(t) values 
are removed or equal to Xi{t) (since di(t) > Fi(t)), and 



w ti,i)(t) < P f° r all 3 € A/] n (t), it follows that 

B(m A /{t) - Xi(t)) < ^2 w (j,i)( t )( x (j,i)( t ) ~ - T *W) 

< B{M M {t)-Xi{t)). 

Finally, the fact that any solution of ([j]) using ([|) is contin- 
uous combined with the above inequality implies the result. 

■ 

It follows from Lemma |thatM 7v -(-) is nonincreasing and 
TO Af(') i s nondecreasing, respectively. Therefore, if agree- 
ment is achieved among the normal agents, then the values 
of the normal agents must converge to a common limit. For 
this reason, we focus on proving that the Lyapunov candidate 
= Mj^fif) — raj^(t) vanishes asymptotically (i.e., 
agreement is achieved). We show that this Lyapunov function 
decreases over sufficiently large time intervals whenever 
the normal nodes update their values according to ARC-P, 
provided the network is sufficiently robust. Before that, we 
first provide a necessary condition for the crash model in 
time-invariant networks. 

A. Necessary Condition 

Theorem 1: Consider a time-invariant network modeled 
by digraph T> = (V, £ ) where each normal node updates its 
value according to ARC-P with parameter / G [0, 1/2] under 
the /-fraction local crash model. If CTRAC is achieved, then 
V is /-fraction robust. 

Proof: Suppose that V is not /-fraction robust. Then, 
there exist nonempty, disjoint subsets S\,S2 C V such that 
neither S\ nor 52 is /-fraction edge reachable. This means 
that \M'f' \S k \< [fdi\ for all i G S k , k G {1, 2}. Suppose 
the initial value of each node in Si is a and each node in <!?2 
is b, with a < b. Let all other nodes have initial values taken 
from the interval [a, b]. Assume all crashing nodes behave 
normally all the time. Then, using ARC-P with parameter 
/, each node i in Si removes the [fdi\ (or fewer) values 
greater than a from outside Si, Likewise, each node j in S2 
removes the [fdj\ (or fewer) values less than b from outside 
^2. Therefore, each node in Si keeps the value a and each 
node in £2 keeps the value b for all t > 0. ■ 

B. Sufficient Condition 

We proved in Theorem [j] that /-fraction robustness is a 
necessary condition for ARC-P with parameter / to achieve 
CTRAC in time-invariant networks under the /-fraction 
local crash model (and therefore necessary also for the 
malicious and Byzantine models). We now show that p- 
fraction robustness, with p > 2/, is sufficient for the /- 
fraction local Byzantine model (and therefore, also sufficient 
for the malicious and crash models). 

Theorem 2: Consider a time-invariant network modeled 
by digraph V = (V, £) under the /-fraction local Byzantine 
model. Suppose each normal node updates its value accord- 
ing to ARC-P with parameter f e [0, 1/2). Then, CTRAC is 
achieved if the network topology is p-fraction robust, where 
2/ <J><1. 



Proof: We know from Lemma [l] that both ]%(■) and 
mj\f(-) are monotone and bounded functions of t. Therefore 
each of them has a limit, denoted by Am and A m , respec- 
tively. Note that if A M = A m , then CTRAC is achieved. 
We prove by contradiction that this must be the case. The 
main idea behind the proof is to use the gap between Am 
and A m and combine this with a careful selection of subsets 
of nodes to show that $(t) will shrink to be smaller than 
the gap Am — A m in finite time (a contradiction). To this 
end, suppose that Am ^ A m (note that Am > A m by 
definition). Since M_\r(t) — > Am monotonically, we have 
Mjv(t) > A M for all t > 0. Similarly, mx{t) < A m for all 
t > 0. Moreover, for each e > there exists t e > such that 
Mtf(t) < Am + e and mj^(t) > A m — e, Vt > t e . Define 
constant eo = (Am — A m )/4 > 0. 

Next, we define the sets of nodes that are vital to the proof. 
For any to > 0, t > to, A > 0, and 7] > 0, define 

X M (t,t ,A,r)) 

= {i e AT: 3t' e [t, t + A] s.t. x t (t') > M^(t ) - rj} 

and 

X m (t,t ,A,r)) 

= {i£j\f: 3t' G [t,t + A] s.t. Xi(t') < mM{t ) + T]}. 

We now proceed by showing that if we choose r\ and 
A small enough, then no normal node can be in both 
X M (t,to, A, 77) and X m (t, to, A, 77) for any t > and 
t > to. First, we require some generic bounds on the normal 
node trajectories. For i G N, we know from Lemma [j] that 
for r G [*',*], 

Xi{r) = Yl w uM T ) ( X CM)( T ) ~ X '( T )) 

<B{M M {t')- Xi {T)), 

whenever the derivative exists, f\ where B = /?( n — 1 — 
min ie j\fj>o{Fi(t)}). Using the integrating factor e s ^ r ~* \ 
and integrating in the sense of Lebesgue over the time 
interval [<' ,t], we have 

Xi (t) < x l {t')e- B{t - t ' ) + M M (t')(l - e - B < t -*' ) ), Vt > t'. 

(4) 

By interchanging the roles of t and t', we have 

Xi(t) > x^e^'-^+Mj^i^il-e 3 ^'-^), Vt<t'. (5) 

Similarly, we can show that for i G N, 

Xi (t) > Xi(t')e- B ^ + m N {t'){\ - e-***-*')), Vt > t', 

(6) 

and 

Xi(t) < x^t'y 3 ^-^ +mjv(t)(l -e B (*'-*)), Vt<t'. (7) 

Now fix r/ < e = (A M - A m )/A and A < log(3)/B, and 
suppose i G XM(t, to, A, 77). Then 3t' G [t, t + A] such that 

5 The solutions of the normal nodes' trajectories are understood in the 
sense of Caratheodory. Hence, it is possible that the derivative of the solution 
does not exist on a set of points in time of Lebesgue measure zero. 



Xi(t') > M_\f(to) — r). Combining this with (||), it follows 
that for s G [t',t+ A], 

Xi(a) > Xip)e- B t-V + m N (t'){l - e" 2 ^-*')) 

> (Afv(*o) - rj)e- B ^ + m A r(t )(l - e~ B ^) 

> {A M - V )e- B ^-^ + mx(t ) - A m e~ B ^ 

> m N {t ) + (A M - A m )e- B{s -^ 

_ Am - A m B(s _ t i) 



A 



A I 



4 
3 

> rnx{to) + -^(Am - A m )e 



-BA 



Am — A m 



> m/s(to) + 77, 

where we have used the fact that A < log(3)/i?. Similarly, 
using (^), it follows that for s G [t, t'], 

Xi(a) > Xi (t')e B ^'-^ + Mjv(s)(1 - e^ 4 '" 8 )) 

> (Mjv(*o) - v)e B{t '- s) + Mat(«)(1 - e s ( 4 '- s )) 

> Mx(s) e 

3 

> A M - -^{A M -A m ) 

> A m + -(A M -A m ) 

> mjv(to) + 

Therefore, i ^ X m (t, to, A, 17). 

Similarly, with the given choices for r\ and A, if j G 
Af m (i,t , A, 77), then 3t' G [t,t + A] such that Xj(t') < 
nw(to) + T). It follows from (Q) that for s € [t',t + A], 

Xj(s) < Xj(t')e- B ^-^ +M M {t')(l - e- B ^-^) 

< (mMto) + rf)e- B ^ + M N {t Q ){l - e~ B ^) 

< Mjsfo) + (v + m^(to) - M^-(io))e- B(s -*' ) 
'A M - A„ 



< M N {t ) 



( A M -A m _ {Am _\ e _ B(s _ 



< Mj^(t ) - ^(A u - A m )e~ BA 



A M - A r 



< A0v(t o ) - ?7, 

where we have used the fact that A < log(3)/S. Finally, 
using (^), it follows that for s G [t,f], 

Xj{s) < x 3 {t')e B ^'-^ +mjv(s)(l - e^ 4 '^) 

< (nw(t ) + ??)e B(t '- s) + mjv(jj)(l - e s ( 4 '~ s >) 

< "w(s) + ve B{t '~ s} 

< A m + ^/-^m eBA 



< J 4 m + -(^4 M -A m ) 



< M M (t ) 

< Mat (to) - 1?. 

Thus, j ^ Xm^i to. A, 77). This shows that Xm (t,to, A, 77) 
and <f TO (t, toj A, 77) are disjoint for appropriate choices of 
the parameters. 

Next, we show that by choosing e small enough, we can 
define a sequence of sets, 



X M ±X M (t e + kA,t e ,A,e k ), k = 0,l, 



and 



X^^X m (t e + kA,t e ,A,e k ) 



0,1,.. 



, -AT, 



where N = \Af\, so that we are guaranteed that by the iVth 
step, at least one of the sets contains no normal nodes. This 
will be used to show that \I/ has shrunk below Am — A m , 
Toward this end, let e = (A M -A m )/4 and A < log(3)/B. 
Then fix 



e < 



1 



B 



(1 



e -BA )e -BA 



2N 



For k = 0, 1, . . . , N, define e k = [f (1 - e 
which results in 



eo- 



-SA\„-SAl2fe, 



e > ei > • • ■ > £n > 2e > 0. 

Observe that by definition, there is at least one normal node 
in X M and X m (the ones with extreme values), and we have 
shown above that all of the X M and X m are disjoint. The in- 
fraction robust assumption (with p > 2f) ensures that there 
exists a (normal) node i in either X M or X m with at least 
\pdi] neighbors outside of either X M or X m , respectively. 
For node i, at most 2[/<iiJ of these values are thrown away 
(with at most [fdi\ of them as adversaries, under the /- 
fraction local model, and at most \_fdi\ of these strictly 
smaller, or larger, than node i's value). Because p > 2/, 
it follows that \pdi\ — 2[fdi\ > 1. Therefore, at least one 
normal value outside of i's set (either X M or X m ) is used. 
Assume i G X M has at least \pdi\ neighbors outside of 
its set. Then, at least one of the values from i's neighbors 
outside of X M is used for almost all t G [t e ,t e + A], Then, 

Xi(t) <a(M M (t t )-e -Xi(t)) 

+ {B - a){M M {t e ) - Xi{t)) 
< -Bxi(t) + BMjs(t e ) - ae , 

for almost all t G [t e ,t e + A]. Using this, we can show 

Xi (t e + A) < Xi(t e )e- BA + (Mjsfa) - ^)(1 - e- BA ) 
< MMQ ~ %(1 - e- BA )e . 

Using this with (|J) to bound Xi(t) for t G [t e + A, t e + 2A], 
we see that for all t G [t e + A, t F + 2A], 



xi{t) <M M (t e )-% [l-e- BA )e 



BA\ -B(t-t t -A] 



—BA\„—BA, 



< A/jv(i e )-ei. 



eo 



Thus, i X^f. The next step is to show that j X} n 
whenever j is a normal node with j £ X® n . Whenever 
j £ X^, it means that Xj(t e + A) > m^f(t e ) + eo. Using 
this with (||) to lower bound xj(t) for t € [t e + A, t e + 2A], 
we see that 



.r 



;(t) > m N {t e ) + e e BA > m N (t t ) + 



Hence, j is also not in X} n , as claimed. Likewise, we can 
show using (||) that j ^ X\ { whenever j is a normal node 
with j ^ A"^. Therefore, if i £ uses at least one normal 
neighbor's value outside of its set, we are guaranteed that 

\ X m\ < \ x m\ and \ x m\ < I'O Usin 8 a similar argument, 
we can show that if i G X^ has at least [pd,-] neighbors 
outside of its set, we are guaranteed that \X^ n \ < \X^\ and 

1*1,1 < 

Now, if both X\ { and X^ are nonempty, we can repeat 
the above argument to show that either \X^\ < \X^\ or 
\ x m\ < \ x m\< or both. It follows by induction that as long 
as both X 3 M and X^ are nonempty, then either < 
\Xl\ or iXif 1 ] < \X J M \ (or both), for j = 1,2,.... Since 



+ I*m I - N > there exists T < N such that at least one 
t „h ; c _ t „ T f _ a then Mjv(i e + TA) < 



of Afj^ and is empty. If A" M 
Mjv(f e ) - e T < MAr(i £ ) - 2e. Similarly, if Aj£ = 0, then 
msf(te + TA) > mj\f(t e ) + £t > "w(^e) + 2e. In either 
case, \E'(t e + TA) < — A m and we reach the desired 
contradiction. ■ 

We now extend the above result to time-varying networks. 

Theorem 3: Consider a time-varying network modeled 
by T>(t) = (V, £(t)) under the /-fraction local Byzantine 
model. Let {tk} denote the switching times of a(t) and 
assume that t^+i — tk > r for all k. Suppose each normal 
node updates its value according to ARC-P with parameter 
/ e [0, 1/2). Then, CTRAC is achieved if there exists t' > 
such that V{t) is p-fraction robust, where 2/ < p < 1, for 
all t > t'. 

Proof: The proof follows the contradiction argument 
of the proof of Theorem [| but here we use the dwell time 
assumption. In this case, let 



A < min{log(3)/B, £}. 



Fix 



e < 



1 



(1 



e )e 



2A' 



eo, 



and let t' e > be a point in time such that M_\f(t) < Am + £ 
and mj^{t) > A m —e for all t > t' e . Define t" = m&x{t' ,t' e }. 
Then, associated to the switching signal a(t), we define t c 
as the next switching instance after t" , or t" itself if there 
are no switching instances after t". Since A < t/N, the 
same sequence of calculations can be used (as in the proof 
of Theorem |) to show that *(t e + TA) < A M - A m . ■ 

VI. CONCLUSION 

This paper studies the continuous-time resilient asymptotic 
consensus problem. The adversary models studied are om- 
niscient and have a scope that is fractional in nature (i.e., at 
most a fraction / of nodes in any normal nodes neighborhood 
are assumed to be compromised). Under these assumptions, 



we show that a fractional version of the Adversarial Robust 
Consensus Protocol (ARC-P) achieves consensus among the 
normal nodes if the network is 2/-fraction robust and only 
if the network is /-fraction robust. Determining a tight 
condition for these adversary models is a matter of future 
work. 

References 

[1] Q. Li and D. Rus, "Global clock synchronization in sensor networks," 
IEEE Transactions on Computers, vol. 55, no. 2, pp. 214-226, Feb. 
2006. 

[2] A. Jadbabaie, J. Lin, and A. S. Morse, "Coordination of groups 
of mobile autonomous agents using nearest neighbor rules," IEEE 
Transactions on Automatic Control, vol. 48, no. 6, pp. 988-1001, June 
2003. 

[3] V. Gupta, C. Langbort, and R. M. Murray, "On the robustness of 

distributed algorithms," in IEEE Conference on Decision and Control, 

San Diego, California, Dec. 2006, pp. 3473-3478. 
[4] N. A. Lynch, Distributed Algorithms. San Francisco, California: 

Morgan Kaufmann Publishers Inc., 1997. 
[5] J. Hromkovic, R. Klasing, A. Pelc, P. Ruzicka, and W. Unger, 

Dissemination of Information in Communication Networks. Springer- 

Verlag, 2005. 

[6] L. Lamport, R. Shostak, and M. Pease, "The Byzantine generals 
problem," ACM Trans. Program. Lang. Syst., vol. 4, no. 2, pp. 382- 
401, 1982. 

[7] D. Dolev, N. A. Lynch, S. S. Pinter, E. W. Stark, and W. E. Weihl, 
"Reaching approximate agreement in the presence of faults," Journal 
of the ACM, vol. 33, no. 3, pp. 499-516, 1986. 

[8] R. M. Kieckhafer and M. H. Azadmanesh, "Reaching approximate 
agreement with mixed mode faults," IEEE Transactions on Parallel 
and Distributed Systems, vol. 5, no. 1, pp. 53-63, 1994. 

[9] N. Agmon and D. Peleg, "Fault-tolerant gathering algorithms for 
autonomous mobile robots," SIAM Journal on Computing, vol. 36, 
no. 1, pp. 56-82, July 2006. 
[10] H. Zhang and S. Sundaram, "Robustness of information diffusion 
algorithms to locally bounded adversaries," in Proceedings of the 
American Control Conference, Montreal, Canada, 2012, pp. 5855- 
5861. 

[11] H. J. LeBlanc and X. D. Koutsoukos, "Low complexity resilient 
consensus in networked multi-agent systems with adversaries," in 
Proceedings of the 15th international conference on Hybrid systems: 
computation and control, ser. (HSCC '12), Beijing, China, 2012, pp. 
5-14. 

[12] H. J. LeBlanc, H. Zhang, S. Sundaram, and X. Koutsoukos, "Consen- 
sus of multi-agent networks in the presence of adversaries using only 
local information," in Proceedings of the 1 st International Conference 
on High Confidence Networked Systems (HiCoNS), Beijing, China, 
2012, pp. 1-10. 

[13] N. H. Vaidya, L. Tseng, and G. Liang, "Iterative approximate Byzan- 
tine consensus in arbitrary directed graphs," in Proceedings of the ACM 
symposium on Principles of distributed computing (PODC), Madeira, 
Portugal, 2012, pp. 365-374. 

[14] H. J. LeBlanc and X. D. Koutsoukos, "Consensus in networked 
multi-agent systems with adversaries," in Proceedings of the 14th 
international conference on Hybrid systems: computation and control, 
ser. (HSCC '11), Chicago, IL, 2011, pp. 281-290. 

[15] W. Zeng, M.-Y. Chow, and P. Ning, "Secure distributed control in 
unreliable D-NCS," in IEEE International Symposium on Industrial 
Electronics (ISIE), 2012, pp. 1858-1863. 

[16] H. J. LeBlanc, H. Zhang, X. D. Koutsoukos, and S. Sundaram, 
"Resilient asymptotic consensus in robust networks," IEEE Journal 
on Selected Areas in Communications, 2013, to appear in the special 
issue on In-Network Computation: Exploring the Fundamental Limits. 

[17] S. Jaggi, M. Langberg, S. Katti, T. Ho, D. Katabi, and M. Medard, 
"Resilient network coding in the presence of Byzantine adversaries," 
in 26th IEEE International Conference on Computer Communications, 
1NFOCOM, Anchorage, AL, May 2007, pp. 616-624. 

[18] S. Sundaram and C. N. Hadjicostis, "Distributed function calculation 
via linear iterative strategies in the presence of malicious agents," IEEE 
Transactions on Automatic Control, vol. 56, no. 7, pp. 1495-1508, July 
2011. 



[19] F. Pasqualetti, A. Bicchi, and F. Bullo, "Consensus computation in 
unreliable networks: A system theoretic approach," IEEE Transactions 
on Automatic Control, vol. 57, no. 1, pp. 90-104, Jan. 2012. 

[20] D. Easley and J. Kleinberg, Networks, Crowds and Markets: Reason- 
ing about a Highly Connected World. Cambridge University Press, 
2010. 

[21] R. Olfati-Saber, J. A. Fax, and R. M. Murray, "Consensus and 
cooperation in networked multi-agent systems," Proceedings of the 
IEEE, vol. 95, no. 1, pp. 215-233, 2007. 

[22] W. Ren and R. W. Beard, "Consensus seeking in multiagent systems 
under dynamically changing interaction topologies," IEEE Transac- 
tions on Automatic Control, vol. 50, no. 5, pp. 655-661, May 2005. 

[23] L. Moreau, "Stability of continuous-time distributed consensus algo- 
rithms," in IEEE Conference on Decision and Control, vol. 4, Dec. 
2004, pp. 3998^003. 

[24] H. J. LeBlanc, "Resilient cooperative control of networked multi- 
agent systems," Ph.D. dissertation, Department of EECS, Vanderbilt 
University, 2012. 



